{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-93226 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-93226 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-93226 and fix it if it is affected.\n\nWhat it is: CVE-2026-93226 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-93226 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-93226/ (Markdown: https://insights.sbomify.com/CVE-2026-93226/index.md)","id":"CVE-2026-93226","markdown":"https://insights.sbomify.com/CVE-2026-93226/index.md","name":"CVE-2026-93226","record":{"aliases":["BELL-CVE-2026-93226","DEBIAN-CVE-2026-93226","GHSA-wvgv-43w8-m5vv","UBUNTU-CVE-2026-93226"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel IPv6 route exception dumping allows local attackers to cause a denial of service via concurrent network updates.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU iterator to dump route exceptions\n\nrt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over\nRCU-protected exception lists. The caller holds rcu_read_lock(), but does\nnot hold rt6_exception_lock, so rt6_insert_exception() can concurrently\nadd an entry with hlist_add_head_rcu().\n\nKCSAN reports this race (irrelevant details omitted):\n\n  ==================================================================\n  BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions\n\n  write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:\n    rt6_insert_exception+0x3bb/0x760\n    __ip6_rt_update_pmtu+0x4fe/0x750\n    ip6_sk_update_pmtu+0x19a/0x3b0\n    udpv6_err+0x3ff/0x800\n    icmpv6_notify+0x1e1/0x440\n    icmpv6_rcv+0x8c0/0xab0\n    ip6_protocol_deliver_rcu+0x616/0x840\n    ip6_input_finish+0xb9/0x160\n    ...\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:\n    rt6_nh_dump_exceptions+0xb3/0x260\n    rt6_dump_route+0x53e/0x5f0\n    fib6_dump_node+0x6d/0xf0\n    fib6_walk_continue+0x290/0x2d0\n    fib6_dump_table+0x28d/0x360\n    inet6_dump_fib+0x37d/0x620\n    rtnl_dumpit+0x7b/0xd0\n    netlink_dump+0x3ae/0x7e0\n    ...\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  4 locks held by dumper/549:\n    ...\n    #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620\n    #2: (\u0026tb-\u003etb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360\n    #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0\n\n  value changed: 0xffff8a7c44e05700 -\u003e 0xffff8a7c45d60100\n\n  Reported by Kernel Concurrency Sanitizer on:\n  CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted\n  7.2.0-rc7-virtme #38 PREEMPT(lazy)\n  ...\n\nUse hlist_for_each_entry_rcu() to safely iterate over the exception list.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ipv6: use RCU iterator to dump route exceptions","id":"CVE-2026-93226","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn","id":"CVE-2026-93227"},"packages":[],"prev":{"headline":"phy: fsl-imx8mq-usb: fix typec switch leak on probe error path","id":"CVE-2026-93225"},"products":["Linux"],"published":"2026-09-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel IPv6 route exception dumping allows local attackers to cause a denial of service via concurrent network updates.","url":"https://insights.sbomify.com/CVE-2026-93226/"}